Kernel Version 5.2 Exports

The large table on this page lists the 45 exports that were added to the Windows kernel in its first release for version 5.2., i.e., for the original Windows Server 2003. All but one are still exported as of version 6.0.

The substantial additions for Windows Server 2003 SP1 are listed separately, as are the few additions for Windows Server 2003 SP2. Some other exports perhaps were designed for version 5.2 but appear first, in order of version number, as additions for Windows 2000 SP4.

Documentation status is summarised by colour coding so that more detail can be given as Remarks with less text. Functions that have their own non-trivial documentation are shown with no background colour. If the whole of the documentation is just that the function is reserved or obsolete, without even giving a prototype, then the function is highlighted red or highlighted pink, respectively. An undocumented function that is at least declared in one or another header file from the Windows Driver Kit (WDK) is highlighted orange. Functions that appear to be completely undocumented are highlighted yellow. If a function is documented now but is known not to have been documented in the first contemporaneous Device Driver Kit (DDK), WDK or Installable File System (IFS), then it is shaded yellow to retain some of its previous status as undocumented.

Just more than a third of these new exports for version 5.2 are nowadays documented. For most, the documentation states that the function is “available on Microsoft Windows Server 2003 and later”. A handful are documented as if they are not available until Windows Vista. Two functions are documented only as being reserved, without even saying which versions have them. Another third of the new functions are undocumented but with declarations in one or another of the WDK header files (actually all in NTIFS.H). Declarations, both of these and the documented functions, are mostly for Windows Server 2003 and higher. The other third of the new functions have neither documentation nor declaration.

Function Remarks
DbgCommandString  
ExfUnblockPushLock  
FsRtlAddBaseMcbEntry  
FsRtlGetNextBaseMcbEntry  
FsRtlInitializeBaseMcb  
FsRtlLookupBaseMcbEntry  
FsRtlLookupLastBaseMcbEntry  
FsRtlLookupLastBaseMcbEntryAndIndex  
FsRtlNumberOfRunsInBaseMcb  
FsRtlRemoveBaseMcbEntry  
FsRtlResetBaseMcb  
FsRtlSplitBaseMcb  
FsRtlTruncateBaseMcb  
FsRtlUninitializeBaseMcb  
IoCsqInitializeEx documents earlier availability through statically-linked library CSQ.LIB for Windows 2000 and higher
IoCsqInsertIrpEx documents earlier availability through statically-linked library CSQ.LIB for Windows 2000 and higher
IoGetPagingIoPriority undocumented until 2005-2006
KdRefreshDebuggerNotPresent  
KeAcquireInStackQueuedSpinLockForDpc undocumented until 2005-2006;
documentation requires Windows Vista and higher;
declaration requires Windows Vista and higher
KeAcquireSpinLockForDpc undocumented until 2005-2006;
documentation requires Windows Vista and higher
KeDeregisterNmiCallback documented before available, at least as early as 2002;
documentation until 2002-2005 requires Windows XP and higher
KeGenericCallDpc  
KeInitializeThreadedDpc undocumented until 2005-2006;
documentation requires Windows Vista and higher
KeInvalidateAllCaches undocumented until 2005-2006
KeIpiGenericCall undocumented until 2005-2006
KeRegisterNmiCallback documented before available, at least as early as 2002;
documentation until 2002-2005 requires Windows XP and higher
KeReleaseInStackQueuedSpinLockForDpc undocumented until 2005-2006;
documentation requires Windows Vista and higher;
declaration requires Windows Vista and higher
KeReleaseSpinLockForDpc undocumented until 2005-2006;
documentation requires Windows Vista and higher
KeSignalCallDpcDone  
KeSignalCallDpcSynchronize  
KeTestSpinLock undocumented until 2005-2006
KiCheckForKernelApcDelivery  
MmCreateMirror undocumented until 2005-2006
MmIsIoSpaceActive undocumented until 2005-2006
PsGetProcessSessionIdEx  
RtlInitAnsiStringEx  
RtlInitUnicodeStringEx declaration requires Windows XP and higher
WmiTraceFastEvent discontinued in 6.0
ZwAddDriverEntry  
ZwDeleteDriverEntry  
ZwEnumerateDriverEntries  
ZwModifyBootEntry  
ZwModifyDriverEntry  
ZwQueryDriverEntryOrder  
ZwSetDriverEntryOrder